Splunk Search

How to add columns from a lookup table to my search?

kcchu01
Explorer

I have a lookup table sample_lookup.csv which consists of two fields, wildcard and location

wildcard    location
   *123*        ABC
   *456*        DEF

I would like to add the location field to the existing search and create a new table so I can finally count the number of entries in each location.
My existing search is as follows.

Sample1    UserID 
212389        AAA
345699        BBB
412366        CCC
545688        DDD

I would like to have the table like this by matching the wildcard in the lookup table and add a location field in the new table:

Sample1    UserID    Location
212389        AAA        ABC
345699        BBB        DEF
412366        CCC        ABC
545688        DDD        DEF

How can I make use of lookup to achieve this? It really stuck me for a long time =(

0 Karma

woodcock
Esteemed Legend

Another option is described here (but you should go with the other one proposed):

https://answers.splunk.com/answers/386488/regex-in-lookuptable.html#answer-387536

0 Karma

sundareshr
Legend

In your lookup table add wildcard chars to your "wildcard" column, like this *123* OR *456*. Then in your transforms, under the stanza for the lookup, add

 match_type = WILDCARD(wildcard) 

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf

Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...